gryf/wmaker
1
0
Fork 0
mirror of https://github.com/gryf/wmaker.git synced 2026-01-03 04:14:20 +01:00
Code Issues Projects Releases Wiki Activity

Menu parser: added boundary checks in the path-gen for #include file search

Browse Source 
When generating the full path+name of file to search for a file
being #included, it was generated in a buffer that's supposedly
large enough (MAXLINE > 2*PATH_MAX). However, this limit has a few
issues (PATH_MAX seem to be able to be bigger, and worse: we can't
be sure we're given longer args).

The code was rewrote to natively include boundary checks so we're
sure we won't overflow the buffer. A few strncpy have been removed
because in this case they tend to make things harder to write.
This commit is contained in:
Christophe CURIS
2012-07-18 00:02:22 +02:00
committed by Carlos R. Mafra
parent ac52d4de65
commit 9ad278ddf8
1 changed files with 17 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
WINGs/menuparser.c
View File

@@ -474,22 +474,31 @@ static Bool menu_parser_include_file(WMenuParser parser)
if (fh == NULL) {
if (req_filename[0] != '/') {
const char *src;
int idx;
fullfilename = buffer;
src = parser->include_default_paths;
while (*src != '\0') {
p = buffer;
idx = 0;
if (*src == '~') {
char *home = wgethomedir();
while (*home != '\0')
*p++ = *home++;
while (*home != '\0') {
if (idx < sizeof(buffer) - 2)
buffer[idx++] = *home;
home++;
}
src++;
}
while ((*src != '\0') && (*src != ':'))
*p++ = *src++;
*p++ = '/';
strncpy(p, req_filename, sizeof(buffer) - (p - buffer - 1));
buffer[sizeof(buffer) - 1] = '\0';
while ((*src != '\0') && (*src != ':')) {
if (idx < sizeof(buffer) - 2)
buffer[idx++] = *src;
src++;
}
buffer[idx++] = '/';
for (p = req_filename; *p != '\0'; p++)
if (idx < sizeof(buffer) - 1)
buffer[idx++] = *p;
buffer[idx] = '\0';
fh = fopen(fullfilename, "rb");
if (fh != NULL) goto found_valid_file;